Device for the control of an active element of an occupant retention system in a vehicle

ABSTRACT

In order to produce a safing concept, an extra-safing-sensor in the control unit (ECU) is foregone and the safing function from one of the available acceleration or turn-rate sensors (S 1  to S 5 ) is replaced. Furthermore a pre-stage is connected to the firing element (Z 1 , Z 2 ), before the existing firing path, which, depending upon the sensor signals as analysed by the controller unit ( 1 ), controls a safety switch (T 11 ), in series with the firing switches and the firing element.

CLAIM FOR PRIORITY

This application claims priority to International Application No.PCT/DE01/01827 which was published in the German language on May 14,2001.

TECHNICAL FIELD OF THE INVENTION

The invention relates to a device for driving an active element of anoccupant restraint system of a vehicle.

BACKGROUND OF THE INVENTION

Conventional occupant restraint systems have a mechanical safing sensorincorporated in the central controller of the occupant restraint system.The previous mechanical safing sensors usually arranged in the controlunit (ECU) of the restraint system are difficult to test, slow andrelatively expensive.

A safing concept with a safing function in the restraint system meansthat an undesirable triggering of the occupant restraint system in theevent of a malfunction of the impact identification unit, which has thesensors and the controller of the occupant restraint system, isprevented. To date, this has only been realized for the identificationof a frontal impact or a side impact with subsequent activation of thefront airbags or side airbags. To date, there has not been a reliablesafing concept for the identification of a rollover with subsequenttriggering of side airbags, curtains, etc.

SUMMARY OF THE INVENTION

The invention discloses an occupant restraint system with acost-effective and reliable safing concept.

One advantage of the invention is to allow one safing sensor to besaved. To that end, the detection of a frontal impact with the aid of asafing sensor is shifted into the early crash satellite or sensor, whichis preferably integrated in the front part of the vehicle, e.g. in thefender thereof and/or in the front engine compartment.

For the safing function in the identification of a side impact, theacceleration sensor in the Y direction, i.e. in the direction of thewheel axles transversely with respect to the vehicle direction, issimultaneously used as a safing sensor.

For the safing function in the identification of a rollover state, atleast one of the acceleration sensors which act in the y direction andin the z direction is simultaneously used as a safing sensor.

In another embodiment, there are a plurality of participating sensorswhich simultaneously fulfill the function of safing sensors.

For the evaluation of the sensor signals, a control unit (ECU) withdownstream, multistage safety switches, for example comprising aprestage with two transistors and a safety transistor connecteddownstream, is used to realize a safing concept.

A safety switch is additionally provided in the ignition path includingthe ignition element, the energy store and the ignition switches.Ignition of the ignition element occurs when both the ignitionswitch/switches and the safety switch turn on simultaneously. The safetytransistor in the ignition path is driven by a prestage which enablesthe safety switch when a sufficiently high acceleration is present.

In still another embodiment, the prestage comprises two switches whichin each case receive control signals from the controller and turn onwhen an impact is identified. The prestage switches are interconnectedwith one another in such a way that both identify input signals of theprestage switches for triggering. In the event of a malfunction of theimpact identification unit, one of the two input signals of the prestageswitches is not activated, so that the safety switch is not turned onand ignition of the ignition element cannot take place. Consequently,inadvertent ignition is prevented.

Through the use of the prestage switches, each sensor, for example anacceleration sensor, early crash satellite or rollover sensor, cansimultaneously perform the safing function.

The prestage switches are preferably of discrete design, but can also beof integrated embodiment. The safety switch is generally of discreteembodiment.

In the event of a short circuit between the two inputs of the prestageswitches, in one embodiment, a potential is produced at the inputs whichis in proximity to the supply voltage or ground and thus inhibits atleast one of the two prestage switches. This ensures that the safetyswitch turns off in the event of a short circuit between the inputs ofthe prestage switches. Equally, an interference effect on the two inputsof the switches does not lead to activation of the safety transistor.

In another embodiment, the evaluation of the sensor signals and thedriving of the ignition path or ignition paths and of the prestageswitches are carried out by a controller. The sensor signals areevaluated in the controller by an evaluation unit which uses thealgorithm to take the ignition decision. Furthermore, a sensor signal isfed to a holding circuit which has different holding times depending onthe function of frontal impact identification, side impactidentification or rollover identification. If the evaluation unit takesthe decision to ignite the ignition element, the ignition transistorsare turned on with the aid of a firing routine. Furthermore, theignition decision is fed in logically combined with the output of theholding element and the prestage switches. The ignition pellet can beignited if the impact identification unit, including the sensors and theairbag control unit, for example, and also the safing function identifyan impact.

In yet another embodiment, the controller is subdivided into twomutually separate units: into a main control unit and a safety controlunit. The main control unit evaluates the sensor signals and drives theignition switches. The safety control unit evaluates the sensor signalsand drives the prestage switches. The hardware separation makes itpossible to absorb software or hardware faults in the control unitthrough two independent, redundant units preferably designed asmicrocontrollers. This is advantageous because increasingly allfunctions may be integrated into the controller and the functions arethus mapped in terms of software. The controller is also referred to ascontrol unit hereinafter.

In another embodiment, the prestage switches are designed as discretetransistors in order to increase the inherent safety, but can also beintegrated. The safety transistor is of discrete construction. Theignition transistor/transistors are preferably arranged on an ASICmodule, but can also be of discrete construction. The multistage conceptof separately constructed modules—the controller, the prestage switchesof discrete construction and the ASIC module separate therefrom—ensuresa high inherent safety and fault protection of the entire system, sothat faulty triggering can be reliably avoided.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention is explained with reference to the drawings, in which:

FIG. 1 shows a drive circuit with a first safing concept.

FIG. 2 shows a drive circuit with a second safing concept.

FIG. 3 shows a further drive circuit.

Elements having the same function and the same construction aredesignated by the same reference symbols in FIGS. 1, 2 and 3.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1 shows a drive arrangement for an active element, designed asignition elements Z1, Z2, for example, in which a controller 1 controlsignition parts with an active element depending on sensor signals.Furthermore, control unit 1 controls prestages R1, T12, T13 and R2, T22,T23, thereby ensuring that the active element Z1, Z2 can be activated orignited when both the impact identification unit and the safing functionhave identified a sufficiently high acceleration.

FIG. 1 shows a plurality of sensors S1 to S5, whose sensor signals arefed to the controller 1. The sensor 1 is designed as an early crashsatellite and is arranged in the front region of the vehicle, preferablyin the region of the fender. As a result, a frontal impact is detectedparticularly early. The early crash satellite has an acceleration sensorwhich preferably detects movements in the direction of travel, i.e. inthe X direction.

The sensor S2 is an acceleration sensor which senses movements in the Xdirection, i.e. movements in the vehicle direction.

The sensor S3 is an acceleration sensor which senses movements oraccelerations in the Z direction, i.e. movements of the vehicle in thevertical direction. As a result, rollover situations, in particular, areidentified in conjunction with the rate-of-rotation sensor S5.

The sensor S4 is an acceleration sensor which identifies movements ofthe vehicle in the Y direction, i.e. movements transversely with respectto the direction of travel of the vehicle. As a result, side impactsituations, in particular, are identified.

The sensor S5 is designed as a rate-of-rotation sensor which identifiesan angular velocity and, derived therefrom, an angular accelerationabout the longitudinal axis of the vehicle, i.e. in the X direction. Asa result, in particular in interaction with the sensor S3 for the Zdirection, rollover states are identified.

The controller 1 includes a first and a second evaluation unit 25, 35,which evaluates the sensor signals and take an ignition decision for thevarious ignition paths VCC, C1, T11, T15, Z1, T16 and VCC, C2, T21, T25,Z2, T26 according to predetermined algorithms. The active elements Z1,Z2 included in the various ignition parts represent, by way of example,ignition elements (ignition pellet, smart squib) of front airbags,ignition elements of seat belt pretensioners, ignition elements of sideairbags, of airbag curtains and further conceivable retractors offurther restraint means.

The first evaluation unit 25 receives the sensor signals from the earlycrash satellites S1 and the acceleration sensor S2 in the X direction.Depending on the temporal profile of the sensor signals, a firingdecision is taken using an algorithm. Said firing decision is forwardedto a holding element 22 and a first activation unit 26, both of whichare arranged in the controller 1.

The first activation unit 26 implements the firing decision andactivates the two ignition switches T15, T16 connected downstream ofsaid unit, which switches are part of the first ignition path.

The below-mentioned switches

-   -   prestage switches,    -   safety switches,    -   ignition switches,        may be any desired controllable switches. They are preferably        designed as bipolar transistors, field-effect transistors,        MOSFET transistors or the like.

The controller 1 furthermore includes a holding unit which preferablyholds a change in the signal from the early crash satellite S1 for apredetermined time duration. This time duration preferably lasts about100 ms. The holding unit bears the reference symbol 21. The output ofthe holding unit 21 is connected to the input B12 of the prestage switchT12 of a prestage R1, T12, T13 via an inverter 23. Furthermore, theoutput of the first holding unit 21 is connected to the input of an ANDelement 24, whose second input is connected of the second holdingelement 22. The output of the AND element is connected to the input B13of the prestage switch T13 of the prestage R1, T12, T13.

The subunits arranged in the control unit 1, e.g. the evaluation units25, 35, the holding units 21, 22, 31, 32, 33, etc., designate functionalsubunits which can be mapped in hardware in the control unit 1 and/or berealized by software operations.

The prestage R1, T12, T13 has two prestage switches T12, T13, whoseactivation branches are connected in series. One end of the activationbranch of the second prestage switch T13 is connected to ground and theother end thereof is connected to one activation branch of the prestagetransistor T12. The other end of the activation branch of the prestagetransistor T12 is connected to the supply voltage VCC via a resistor R1.The node between the resistor R1 and the first prestage switch T12 isconnected to the input B11 of the first safety transistor T11, which ispart of the first ignition path C1, T11, T15, Z1, T16. The firstignition path is designed as a series circuit comprising the firstenergy store, the activation branch of the first safety switch T11, theactivation branch of the first ignition switch T15, the active elementZ1 and the activation branch of the second ignition switch T16. Thefirst energy store C1 has a predetermined energy which suffices toignite the active element, preferably an ignition element of a restraintmeans. In this case, multiple ignitions of an active element or aplurality of active elements Z1 can be triggered depending on the firingroutine of the first activation unit 26. The circuit required forcharging the first energy store C1 is not depicted, in order to simplifythe illustration.

The ignition switches T15, T16 and the safety switch T11 are preferablyarranged on an ASIC module. The prestage transistors T12 and T13 arepreferably of discrete design in order to increase the inherent safetyof the system.

The series circuit of the two ignition switches T15, T16 and the firstsafety switch T11 ensures that the active element Z1 turns on when allthree switches T11, T15, T16 are turned on (ANDing).

The inherent safety of the system is additionally increased by virtue ofthe fact that the safety switch T11 is driven by the prestage R1, T12,T13. By way of example, if the first safety transistor T11 is ap-channel MOSFET transistor, then it turns on if both prestage switchesT12 and T13 are in the on state. If just one of the prestage transistorsT12, T13 is not turned on, then the potential of the input B11 of thefirst safety transistor T11 will assume the potential of the supplyvoltage VCC via the resistor R1, as a result of which the first safetytransistor turns off.

This results in an additional redundancy in the system for the purposeof increasing the reliability with regard to inadvertent ignition.

The first and second prestage transistors T12, T13 are designed forexample as a pnp or npn transistor, respectively.

If a short circuit occurs for example between the inputs and B12 and B13of the prestage switches T12, T13, then the outputs of the control unit1 are designed such that the potential is in proximity either to groundGND or to the supply voltage VCC, so that at least one of the twoprestage switches T12, T13 turns off and, consequently, the first safetyswitch T11 is turned off.

If both acceleration sensors S1, S2 are functioning, then all theswitches T12, T13, T11, T15 and T16 are turned off in the non-triggeringsituation, so that the active element Z1 is not triggered.

If a front impact takes place with the sensors S1, S2 functioning, thenthe early crash satellite S1 reports the impact to the control unit 1somewhat earlier than the acceleration sensor in the X direction S2,since the early crash satellite S1 is accommodated in the front part ofthe vehicle or, for rear impact identification, in the rear part of thevehicle. The temporal offset of the sensor signals is 50 ms, by way ofexample. The first evaluation unit 25 identifies impact and activatesthe firing flag in the second holding unit 22 and activates the ignitionroutine in the first activation unit, as a result of which the twoignition switches T15 and T16 are turned on. The early crash satelliteS1 simultaneously serves as a safing sensor located at the input of theimpact identification unit responsible for the safing function.

In the event of a defective sensor, a defective evaluation unit 25, adefective activation unit 26 or a defective ignition switch T1, T16,will prevent the active element Z1 from triggering.

In the event of a front impact with the early crash satellite S1functioning, the sensor signal is conducted to a holding unit 21, whichprovides an activation signal for a predetermined duration at itsoutput. For the predetermined time duration (100 ms) the prestagetransistor T12 is driven and turned on via the inverter 23. The secondprestage switch T13 is likewise turned on if the activation signals ofthe first holding unit 21 and of the second holding unit 22 produce, viathe AND gate 24, an enable signal, which is HIGH level in the presentcase.

The two holding units 21, 22 are preferably edge-controlled, i.e. anactivation signal is output for a predetermined duration in the event ofa predetermined and defined change in the respective input signals. In afurther embodiment, the holding unit 21, 22 is triggered as soon as arespective predetermined threshold is exceeded. By way of example, if adefect occurs in the early crash sensor, then, directly after the systemhas been switched on, the output of the holding unit 21 becomes activefor a predetermined time duration. After this time duration, the outputis inactive (not ENABLE). Since the second holding unit 22 has adeactivated output in this time duration (not enable), the secondprestage transistor T13 is not turned on. Although the first prestagetransistor T12 was activated for a predetermined time duration, in thiscase by a LOW level signal, the first safety switch T11 remains turnedoff.

In the event of an impact, the defective early crash satellite S1 doesnot change its state such that the first holding unit 21 is activated atits output. If the acceleration sensor S2 in the X direction inconjunction with the first evaluation unit 25 now identifies the impact,although the two ignition transistors T15 and T16 are activated by meansof the firing routine in the first activation unit 26, it isnevertheless the case that the prestage switches T12, T13 remain turnedoff, since the first holding unit 21 is not active at its output.Consequently, the first safety switch T11 is in the off state, as aresult of which no current can flow through the first ignition path andthe active element Z1 is not triggered.

The prestage switches T12 and T13 both turn on when the activationsignals at the outputs of the first and second holding units 21, 22 areactive in a predetermined time window. The time window is about 50 ms inthe exemplary embodiment.

If the acceleration sensor S2 in the X direction is partly defective,and/or the firing decision in the first evaluation unit 25 is incorrect,then although the two ignition switches T15 and T16 may be activated bymeans of the firing routine, it is unlikely that the firing decision ofthe first evaluation unit 25 will occur at the right time in thepredetermined time window to turn on both prestage switches T12, T13.The holding element 21 is not activated in this case, so that thetransistor T11 is not closed and, consequently, the ignition element Z1is not triggered.

The result is a drive arrangement for frontal crash identification withhigh inherent safety.

The lower part of FIG. 1 illustrates a second ignition path C2, T21,T25, Z2, T26 and a second prestage R2, T22, T23, which correspond to thefirst ignition path and the first prestage in terms of theirconstruction and function. Furthermore, a second evaluation unit 35 isarranged in the controller, the sensor signals from the sensors S3, S4,S5 being fed to the unit. The second evaluation unit 35 comprises analgorithm which takes a firing decision for the active element Z2depending on the input signals of the sensors. The firing decision isforwarded to a second activation unit 36 and a fifth holding unit 33,which has a holding time of preferably about 1 second. The secondactivation unit 36 conditions the firing decision and forwardscorresponding signals to the ignition switch T25, T26. The accelerationsensors S3 and S4 which effect detection in the z and y directions acton a third holding unit 31, which preferably has a holding duration ofabout 1 second.

The sensor signals of the acceleration sensor S4 are furthermore fed toa fourth holding unit 32, which is arranged in the control unit 1 andpreferably has a holding duration of 100 ms.

The combination of the three sensors S3, S4, S5 make it possible for thesecond evaluation unit 35 to identify a side impact and a rollover in amanner dependent on the sensor signals and to activate correspondingignition elements symbolized by the active element Z2, for example ofthe side airbag, of the rollover curtain or of other restraint systems.

In principle, the safing concept functions like the concept which hasalready been explained for the identification of a frontal impact withsubsequent activation of the front airbags. In this case, the threesensors S3, S4, S5 simultaneously operate as safing sensors. For theactivation of the ignition element Z2, it is necessary both for theelements connected upstream of the holding elements 31 and 32,respectively, to identify a sufficiently high acceleration and for thealgorithm in the evaluation unit 35 to identify an impact or rollover.The output signals of the third and fourth holding units 31, 32 arecombined with one another by means of an OR element 39. The outputsignal of the OR element 39 is fed via an inverter 37 to the thirdprestage switch 22 of the prestage and to an AND element 38, whichreceives the firing flag from the fifth holding unit 33 as secondoutput. The output signal of the AND element 38 is fed to the fourthprestage switch T23.

The ANDing of the two prestage switches T22, T23 results in a timewindow of about 1 second in a rollover event, which time window isprescribed by the two evaluation units 31 and 33.

In the event of a side impact, the sensor S4 in the y direction isactivated, so that, in this case, the time window for the activation ofthe two prestage switches T22, T23 and the subsequent activation of thesecond safety switch T21 is prescribed by the holding units 32 and 33.

The acceleration sensor S4 in the y direction outputs two differentsignals which serve, on the one hand, for the identification of arollover state and, on the other hand, for the identification of a sideimpact. The two different sensor signals are correspondingly fed to thetwo holding units 31 and 32.

FIG. 2 shows a circuit arrangement for identifying crash situations andfor triggering ignition elements which essentially corresponds to thecircuit arrangement from FIG. 1.

In contrast to the circuit arrangement with regard to FIG. 1, in FIG. 2the control unit 1 from FIG. 1 is subdivided into two subunits, the maincontrol unit 2 and the safety control unit 3.

This subdivision, also effected in terms of hardware, increases theinherent safety of the system. The main control unit 2 includes theevaluation units 25, 35 and the activation units 26, 36. The safetycontrol unit 3 includes the safety functions which serve for driving theprestages R1, T12, T13 and R2, T22, T23. Consequently, the safetycontrol unit 3 contains the various holding units 21, 31, 32 andcorresponding combination elements (OR, AND elements and inverters). Itwould be conceivable also to accommodate the holding units 22, 33 fromFIG. 1 in the safety control unit 3 and to provide correspondingconnections between the main control unit 2 and the safety control unit3. The sensor signals of the acceleration and rate-of-rotation sensorsS1 to S5 are in each case fed into the corresponding function blocks ofthe main control unit 2 and of the safety control unit 3.

The subdivision of the control unit 1 into a main control unit 2 and asafety control unit 3 creates a structure through which a defectiveoperation of a hardware or software unit leads to non-triggering of thecorresponding active units Z2, Z1.

In another embodiment, in contrast to the illustration in FIGS. 1 and 2,the resistors R1 and R2 of the two prestages are not connected to thesupply voltage Vcc, but rather in each case of the first and secondenergy store C1, C2, respectively, which each have an ignitionpotential. This ensures that the safety transistor T11 or T21, designedas p-channel or pnp, reliably turns off independently of the potentialdifference between the supply voltage Vcc and the ignition potential ofthe energy store C1 or C2, respectively, given corresponding driving bythe corresponding prestage.

FIG. 3 illustrates a drive circuit which differs from FIG. 1 in thatcircuit in the region of the prestages R1, T12, T13 and R2, T22, T23 areembodied differently. The change are illustrated by way of example usingthe upper prestage R1, T12, T13.

The output of the inverter 23 is connected to a further inverter 54 viaan output pin of the control unit 1. The output of the further inverter54 is connected to the control input (base/gate) of a prestage switchT52. The output of the AND element 24 is connected to the control input(base/gate) of a further prestage switch T53 via an output pin of thecontrol unit 1. The activation branch of the prestage switch T52 isconnected, on the emitter side or source side, to the potential of theignition capacitor C1 and, on the collector side or drain side, to thecontrol input of the safety transistor T11 and one end of the resistorR5.

The activation branch of the prestage switch T53 is connected, on theemitter side or source side, to ground GND and, on the collector side ordrain side, to the other end of the resistor R5.

The safety switch T11 turns on when the prestage switch T52 is at highresistance, i.e. its activation branch is inhibited, and the prestageswitch T53 turns on. For this, the inputs of the prestage switches T52and T53 must be switched to HIGH and, consequently, the output pins ofthe inverter 23 and of the AND element 24 must be switched to LOW and toHIGH, respectively. The control input of the safety switch T11 is thenpulled to ground, as a result of which the safety switch T11 turns on,the latter being designed by way of example as a p-channel MOSFETtransistor.

The other three possible state combinations at the input of the twoprestage switches T52, T53 lead to the inhibiting of the safetytransistor T11. Thus, in the event of a short circuit between the twooutput pins mentioned or an in-phase interference influence on the twooutput pins, the safety transistor T11 is always turned off.

In a further embodiment, the prestages in accordance with FIG. 2 can bereplaced by the prestages illustrated in FIG. 3.

1. A device to drive an active element of an occupant restraint systemof a vehicle, comprising: a control unit; sensors having signals fed tothe control unit; an ignition path which has an energy store, a safetyswitch, an active element and at least one ignition switch, controlledby the control unit; and a prestage which drives the safety switch andis controlled by the control unit, the prestage enabling the safetyswitch if at least two sensors identify a sufficient acceleration, andthe prestage inhibiting the safety switch if a sensor and/or the controlunit is defective, wherein the prestage has a plurality of prestageswitches whose inputs are connected to the control unit and whosethrough-connection branches are connected in series, a resistor isconnected in series with the through-connection branches, and a safetytransistor turns on when the prestage switches are enabled by thecontrol unit.
 2. The device as claimed in claim 1, wherein one of thesensors is designed as an early crash sensor and one of the sensors isdesigned as an acceleration sensor with detection in the longitudinaldirection.
 3. The device as claimed in claim 1, wherein the prestageenables the safety switch if at least three sensors identify asufficient acceleration.
 4. The device as claimed in claim 1, whereinone of the sensors are designed as an early crash sensor, one of thesensors is designed as an acceleration sensor with detection in thevertical direction and one of the sensors is designed as an accelerationsensor with detection in the transversal direction.
 5. The device asclaimed in claim 1, wherein the prestage has a prestage switch, whoseinput is connected to the control unit and whose through-connectionbranch is connected to the input of the safety switch.
 6. The device asclaimed in claim 1, wherein the prestage comprises prestage switches ofdiscrete construction.
 7. The device as claimed in claim 5, wherein inthe event of a short circuit between two inputs of the prestageswitches, the resulting potential is in proximity to ground or thesupply voltage such that at least one of the prestage switches turnsoff.
 8. The device as claimed in claim 1, wherein the safety switch isinhibited when there is an in-phase interference or a short circuitbetween two inputs of the prestage switches.
 9. The device as claimed inclaim 1, wherein the control unit is subdivided into the followingseparate units: a main control unit, which drives the ignitionswitch/switches, and a safety control unit, which controls the safetyswitch via the prestage, the main control unit and the safety controlunit preferably being designed as microcontrollers and each evaluatingthe signals of the sensors.
 10. The device as claimed in claim 1,wherein a first sensor serving as a safing sensor and designed as anearly crash sensor and/or as an acceleration sensor at least partly inthe x direction.
 11. The device as claimed in claim 1, wherein thecontrol unit is designed as a microcontroller.
 12. The device as claimedin claim 1, wherein the prestage switch/switches, the ignitionswitch/switches, the safety switch/switches are preferably designed asbipolar and/or as field-effect transistors.